@stacksjs/ts-cloud 0.7.93 → 0.7.95

package/dist/{chunk-fbwcv2vf.js → chunk-xp3txtg9.js}

@@ -127,6 +127,8 @@ var PANTRY_PACKAGES = {
   mysql: "mysql.com",
   mariadb: "mariadb.com/server",
   postgres: "postgresql.org",
+  vitess: "vitess.io",
+  etcd: "etcd.io",
   redis: "redis.io",
   memcached: "memcached.org",
   meilisearch: "meilisearch.com",
@@ -171,8 +173,284 @@ function buildPantryServiceScript(services) {
   ]);
 }
 
+// src/drivers/shared/vitess-provision.ts
+var PANTRY_BIN = `${PANTRY_PROJECT_DIR}/pantry/.bin`;
+var VTGATE_MYSQL_PORT = 15306;
+var VTGATE_GRPC_PORT = 15991;
+var VTCTLD_GRPC_PORT = 15999;
+var VTTABLET_GRPC_PORT = 16101;
+var ETCD_CLIENT_PORT = 2379;
+var VITESS_ROOT = "/var/lib/vitess";
+var VITESS_TABLET_UID = 100;
+function enabled(value) {
+  return value === true || typeof value === "object" && value !== null;
+}
+function settings(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function sh2(value) {
+  return `'${String(value).split("'").join("'\\''")}'`;
+}
+function vitessPackages(config) {
+  const version = config.version ? `vitess.io@${config.version}` : "vitess.io";
+  const packages = [version];
+  if (config.mode !== "combo" && !config.etcdEndpoint)
+    packages.push("etcd.io");
+  packages.push("mysql.com@8.0.43");
+  return packages;
+}
+var VITESS_USER = "vitess";
+var UNIT_PATH = `${PANTRY_BIN}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`;
+var VITESS_LIB = "/usr/local/lib/vitess";
+var launchers = new Map;
+function launcherPath(name) {
+  return `${VITESS_LIB}/${name}.sh`;
+}
+function launcherFor(name, command) {
+  launchers.set(name, launcherScript(command));
+  return `/bin/sh ${launcherPath(name)}`;
+}
+function buildLauncherScripts() {
+  const out = [`mkdir -p ${VITESS_LIB}`];
+  for (const [name, body] of launchers) {
+    out.push(`cat > ${launcherPath(name)} <<'TS_CLOUD_VITESS_LAUNCHER_EOF'`, body, "TS_CLOUD_VITESS_LAUNCHER_EOF", `chmod 0755 ${launcherPath(name)}`);
+  }
+  return out;
+}
+function launcherScript(command) {
+  return [
+    "#!/bin/sh",
+    "set -e",
+    `cd ${PANTRY_PROJECT_DIR}`,
+    'eval "$(pantry env 2>/dev/null)" || true',
+    `VT_MYSQL_ROOT="$(dirname "$(dirname "$(readlink -f ${PANTRY_BIN}/mysqld 2>/dev/null)")")"`,
+    `VTROOT="$(dirname "$(dirname "$(readlink -f ${PANTRY_BIN}/mysqlctld 2>/dev/null)")")"`,
+    "export VT_MYSQL_ROOT VTROOT",
+    `exec ${command.join(" ")}`
+  ].join(`
+`);
+}
+function systemdUnit(opts) {
+  const lines = [
+    "[Unit]",
+    `Description=${opts.description}`,
+    `After=network.target${opts.after?.length ? ` ${opts.after.join(" ")}` : ""}`
+  ];
+  if (opts.requires?.length)
+    lines.push(`Requires=${opts.requires.join(" ")}`);
+  lines.push("", "[Service]", "Type=simple", `User=${VITESS_USER}`, `Group=${VITESS_USER}`, `Environment="PATH=${UNIT_PATH}"`, `Environment="VTDATAROOT=${VITESS_ROOT}"`, ...Object.entries(opts.environment ?? {}).map(([k, v]) => `Environment="${k}=${v}"`), ...(opts.execStartPre ?? []).map((c) => `ExecStartPre=${c}`), `ExecStart=${opts.execStart}`, "Restart=always", "RestartSec=5", "LimitNOFILE=65535", "", "[Install]", "WantedBy=multi-user.target");
+  return lines.join(`
+`);
+}
+function writeUnit(name, body) {
+  return [
+    `cat > /etc/systemd/system/${name}.service <<'TS_CLOUD_VITESS_UNIT_EOF'`,
+    body,
+    "TS_CLOUD_VITESS_UNIT_EOF"
+  ];
+}
+function buildVtcomboUnit(config) {
+  const cell = config.cell ?? "zone1";
+  const port = config.vtgatePort ?? VTGATE_MYSQL_PORT;
+  const keyspaces = ((config.keyspaces?.length) ? config.keyspaces : [{ name: "app" }]).map((k) => {
+    const shards = (k.sharded ? ["-80", "80-"] : ["0"]).map((s) => `shards:{name:"${s}"}`).join(" ");
+    return `keyspaces:{name:"${k.name}" ${shards}}`;
+  }).join(" ");
+  const topology = `${keyspaces} cells:"${cell}"`;
+  return systemdUnit({
+    description: "Vitess (vtcombo, single-process development stack)",
+    execStart: launcherFor("vtcombo", [
+      `${PANTRY_BIN}/vtcombo`,
+      `--cell ${cell}`,
+      `--proto-topo ${sh2(topology)}`,
+      `--mysql-server-port ${port}`,
+      "--mysql-server-bind-address 127.0.0.1",
+      "--mysql-auth-server-impl none",
+      "--start-mysql",
+      `--port ${VTGATE_GRPC_PORT}`,
+      `--grpc-port ${VTCTLD_GRPC_PORT}`
+    ])
+  });
+}
+function buildEtcdUnit() {
+  return systemdUnit({
+    description: "etcd (Vitess topology store)",
+    execStart: launcherFor("etcd", [
+      `${PANTRY_BIN}/etcd`,
+      `--data-dir ${VITESS_ROOT}/etcd`,
+      `--listen-client-urls http://127.0.0.1:${ETCD_CLIENT_PORT}`,
+      `--advertise-client-urls http://127.0.0.1:${ETCD_CLIENT_PORT}`
+    ]),
+    execStartPre: [`+/bin/mkdir -p ${VITESS_ROOT}/etcd`, `+/bin/chown ${VITESS_USER}:${VITESS_USER} ${VITESS_ROOT}/etcd`]
+  });
+}
+function topoFlags(config) {
+  const endpoint = config.etcdEndpoint ?? `http://127.0.0.1:${ETCD_CLIENT_PORT}`;
+  return [
+    "--topo-implementation etcd2",
+    `--topo-global-server-address ${endpoint}`,
+    "--topo-global-root /vitess/global"
+  ];
+}
+function buildVtctldUnit(config) {
+  const requiresEtcd = !config.etcdEndpoint;
+  return systemdUnit({
+    description: "Vitess vtctld (control plane)",
+    after: requiresEtcd ? ["vitess-etcd.service"] : [],
+    requires: requiresEtcd ? ["vitess-etcd.service"] : [],
+    execStart: launcherFor("vtctld", [
+      `${PANTRY_BIN}/vtctld`,
+      ...topoFlags(config),
+      `--cell ${config.cell ?? "zone1"}`,
+      `--service-map grpc-vtctl,grpc-vtctld`,
+      `--grpc-port ${VTCTLD_GRPC_PORT}`,
+      `--port ${VTCTLD_GRPC_PORT + 1}`
+    ])
+  });
+}
+function buildVttabletUnit(config, keyspace, shard) {
+  const cell = config.cell ?? "zone1";
+  return systemdUnit({
+    description: `Vitess vttablet (${keyspace}/${shard})`,
+    after: ["vitess-vtctld.service", "vitess-mysqlctld.service"],
+    requires: ["vitess-mysqlctld.service"],
+    execStart: launcherFor("vttablet", [
+      `${PANTRY_BIN}/vttablet`,
+      ...topoFlags(config),
+      `--tablet-path ${cell}-${String(VITESS_TABLET_UID).padStart(10, "0")}`,
+      `--init-keyspace ${keyspace}`,
+      `--init-shard ${shard}`,
+      "--init-tablet-type replica",
+      `--service-map ${sh2("grpc-queryservice,grpc-tabletmanager,grpc-updatestream")}`,
+      `--port ${VTTABLET_GRPC_PORT}`,
+      `--grpc-port ${VTTABLET_GRPC_PORT + 1}`,
+      `--db-port ${config.mysqlPort ?? 3306}`,
+      `--mycnf-mysql-port ${config.mysqlPort ?? 3306}`
+    ])
+  });
+}
+function buildMysqlctldUnit(config) {
+  return systemdUnit({
+    description: "Vitess mysqlctld (managed mysqld)",
+    execStart: launcherFor("mysqlctld", [
+      `${PANTRY_BIN}/mysqlctld`,
+      `--tablet-uid ${VITESS_TABLET_UID}`,
+      `--mysql-port ${config.mysqlPort ?? 3306}`,
+      '--init-db-sql-file "$VTROOT/config/init_db.sql"',
+      "--wait-time 2m"
+    ]),
+    execStartPre: [`+/bin/mkdir -p ${VITESS_ROOT}`, `+/bin/chown ${VITESS_USER}:${VITESS_USER} ${VITESS_ROOT}`]
+  });
+}
+var VITESS_AUTH_FILE = "/etc/vitess/auth.json";
+function buildVitessAuthFileScript(config) {
+  const user = config.username ?? "vitess";
+  const password = config.password ?? "";
+  const auth = JSON.stringify({ [user]: [{ MysqlNativePassword: "", Password: password, UserData: user }] });
+  return [
+    "mkdir -p /etc/vitess",
+    `cat > ${VITESS_AUTH_FILE} <<'TS_CLOUD_VITESS_AUTH_EOF'`,
+    auth,
+    "TS_CLOUD_VITESS_AUTH_EOF",
+    `chown ${VITESS_USER}:${VITESS_USER} ${VITESS_AUTH_FILE}`,
+    `chmod 0600 ${VITESS_AUTH_FILE}`
+  ];
+}
+function buildVtgateUnit(config) {
+  const cell = config.cell ?? "zone1";
+  return systemdUnit({
+    description: "Vitess vtgate (query router)",
+    after: ["vitess-vtctld.service"],
+    execStart: launcherFor("vtgate", [
+      `${PANTRY_BIN}/vtgate`,
+      ...topoFlags(config),
+      `--cell ${cell}`,
+      `--cells-to-watch ${cell}`,
+      "--tablet-types-to-wait PRIMARY,REPLICA",
+      `--service-map ${sh2("grpc-vtgateservice")}`,
+      `--mysql-server-port ${config.vtgatePort ?? VTGATE_MYSQL_PORT}`,
+      `--mysql-server-bind-address ${config.bindAddress ?? "127.0.0.1"}`,
+      "--mysql-auth-server-impl static",
+      `--mysql-auth-server-static-file ${VITESS_AUTH_FILE}`,
+      `--port ${VTGATE_GRPC_PORT}`,
+      `--grpc-port ${VTGATE_GRPC_PORT + 1}`
+    ])
+  });
+}
+function buildVitessBootstrapScript(config) {
+  const cell = config.cell ?? "zone1";
+  const endpoint = config.etcdEndpoint ?? `http://127.0.0.1:${ETCD_CLIENT_PORT}`;
+  const client = `${PANTRY_BIN}/vtctldclient --server 127.0.0.1:${VTCTLD_GRPC_PORT}`;
+  const out = [
+    `for i in $(seq 1 30); do ${client} GetCellInfoNames >/dev/null 2>&1 && break; sleep 2; done`,
+    `if ! ${client} GetCellInfoNames 2>/dev/null | grep -qx ${sh2(cell)}; then`,
+    `  ${client} AddCellInfo --root ${sh2(`/vitess/${cell}`)} --server-address ${sh2(endpoint)} ${sh2(cell)}`,
+    "fi"
+  ];
+  for (const keyspace of config.keyspaces ?? []) {
+    const sharded = keyspace.sharded ? " --sharded" : "";
+    out.push(`if ! ${client} GetKeyspace ${sh2(keyspace.name)} >/dev/null 2>&1; then`, `  ${client} CreateKeyspace${sharded} ${sh2(keyspace.name)}`, "fi");
+    const alias = `${cell}-${String(VITESS_TABLET_UID).padStart(10, "0")}`;
+    for (const shard of keyspace.sharded ? ["-80", "80-"] : ["0"]) {
+      const target = `${keyspace.name}/${shard}`;
+      out.push(`for i in $(seq 1 30); do ${client} GetTablet ${sh2(alias)} >/dev/null 2>&1 && break; sleep 2; done`, `if ! ${client} GetShard ${sh2(target)} 2>/dev/null | grep -q '"primary_alias"'; then`, `  ${client} PlannedReparentShard ${sh2(target)} --new-primary ${sh2(alias)} || ${client} InitShardPrimary --force ${sh2(target)} ${sh2(alias)}`, "fi");
+    }
+  }
+  return out;
+}
+function buildVitessHealthCheck(config) {
+  const port = config.vtgatePort ?? VTGATE_MYSQL_PORT;
+  return [
+    `for i in $(seq 1 60); do`,
+    `  if (cd ${PANTRY_PROJECT_DIR} && eval "$(pantry env 2>/dev/null)"; MYSQL_PWD=${sh2(config.password ?? "")} ${PANTRY_BIN}/mysql -h 127.0.0.1 -P ${port} -u ${sh2(config.username ?? "vitess")} --connect-timeout=2 -e 'SHOW KEYSPACES') >/dev/null 2>&1; then`,
+    `    echo "vtgate is serving on ${port}"; exit 0`,
+    "  fi",
+    "  sleep 2",
+    "done",
+    `echo "vtgate did not become ready on port ${port}" >&2`,
+    "exit 1"
+  ];
+}
+function buildVitessProvisionScript(value) {
+  if (!enabled(value))
+    return [];
+  const config = settings(value);
+  const combo = config.mode === "combo";
+  launchers.clear();
+  const out = [
+    ...buildPantryInstallScript(vitessPackages(config)),
+    `id -u ${VITESS_USER} >/dev/null 2>&1 || useradd --system --home-dir ${VITESS_ROOT} --shell /usr/sbin/nologin ${VITESS_USER}`,
+    `mkdir -p ${VITESS_ROOT}`,
+    `chown -R ${VITESS_USER}:${VITESS_USER} ${VITESS_ROOT}`
+  ];
+  if (combo) {
+    out.push(...writeUnit("vitess-vtcombo", buildVtcomboUnit(config)), ...buildLauncherScripts(), "systemctl daemon-reload", "systemctl enable --now vitess-vtcombo.service", ...buildVitessHealthCheck(config));
+    return out;
+  }
+  out.push(...buildVitessAuthFileScript(config));
+  const units = [];
+  if (!config.etcdEndpoint)
+    units.push(["vitess-etcd", buildEtcdUnit()]);
+  units.push(["vitess-vtctld", buildVtctldUnit(config)], ["vitess-mysqlctld", buildMysqlctldUnit(config)], ["vitess-vtgate", buildVtgateUnit(config)]);
+  for (const keyspace of config.keyspaces ?? []) {
+    for (const shard of keyspace.sharded ? ["-80", "80-"] : ["0"])
+      units.push([`vitess-vttablet-${keyspace.name}-${shard.replace(/-/g, "x")}`, buildVttabletUnit(config, keyspace.name, shard)]);
+  }
+  for (const [name, body] of units)
+    out.push(...writeUnit(name, body));
+  out.push(...buildLauncherScripts());
+  out.push("systemctl daemon-reload");
+  for (const [name] of units)
+    out.push(`systemctl enable --now ${name}.service`);
+  out.push(...buildVitessBootstrapScript(config), ...buildVitessHealthCheck(config));
+  return out;
+}
+
 // src/drivers/shared/db-provision.ts
+var ALWAYS_EXTERNAL_ENGINES = new Set(["singlestore", "vitess"]);
 function isLocalDatabase(database) {
+  if (database?.engine && ALWAYS_EXTERNAL_ENGINES.has(database.engine))
+    return false;
   return !database?.host || database.host === "127.0.0.1" || database.host === "localhost";
 }
 function pgAdminCommand(database, tool = "psql") {
@@ -183,32 +461,32 @@ function pgAdminCommand(database, tool = "psql") {
   const env = database?.password ? `PGPASSWORD='${database.password.replace(/'/g, `'\\''`)}' ` : "";
   return `${env}${tool} -h ${database.host} -p ${port} -U ${user} -w`;
 }
-function enabled(spec) {
+function enabled2(spec) {
   return spec === true || typeof spec === "object" && spec != null;
 }
 function planServices(services) {
   const packages = [];
   const names = [];
-  if (enabled(services.mysql)) {
+  if (enabled2(services.mysql)) {
     packages.push(typeof services.mysql === "object" && services.mysql.version ? `mysql.com@${services.mysql.version}` : "mysql.com@8.0.43");
     names.push("mysql");
-  } else if (enabled(services.mariadb)) {
+  } else if (enabled2(services.mariadb)) {
     packages.push(PANTRY_PACKAGES.mariadb);
     names.push("mariadb");
   }
-  if (enabled(services.postgres)) {
+  if (enabled2(services.postgres)) {
     packages.push("postgresql.org");
     names.push("postgres");
   }
-  if (enabled(services.redis)) {
+  if (enabled2(services.redis)) {
     packages.push("redis.io");
     names.push("redis");
   }
-  if (enabled(services.memcached)) {
+  if (enabled2(services.memcached)) {
     packages.push("memcached.org");
     names.push("memcached");
   }
-  if (enabled(services.meilisearch)) {
+  if (enabled2(services.meilisearch)) {
     packages.push("meilisearch.com");
     names.push("meilisearch");
   }
@@ -216,9 +494,14 @@ function planServices(services) {
 }
 function buildServicesProvisionScript(services = {}, _options = {}) {
   const plan = planServices(services);
+  const vitess = buildVitessProvisionScript(services.vitess);
   if (plan.packages.length === 0)
-    return [];
-  return [...buildPantryInstallScript(plan.packages), ...buildPantryServiceScript(plan.services)];
+    return vitess;
+  return [
+    ...buildPantryInstallScript(plan.packages),
+    ...buildPantryServiceScript(plan.services),
+    ...vitess
+  ];
 }
 function buildDatabaseSetupScript(database, services = {}) {
   if (!database?.name)
@@ -228,9 +511,9 @@ function buildDatabaseSetupScript(database, services = {}) {
   const name = database.name;
   const user = database.username || name;
   const pass = database.password || "";
-  const usePostgres = enabled(services.postgres) || database.engine === "postgres";
-  const useMariadb = enabled(services.mariadb) || database.engine === "mariadb";
-  const useMysql = enabled(services.mysql) || database.engine === "mysql";
+  const usePostgres = enabled2(services.postgres) || database.engine === "postgres";
+  const useMariadb = enabled2(services.mariadb) || database.engine === "mariadb";
+  const useMysql = enabled2(services.mysql) || database.engine === "mysql";
   if (usePostgres && !useMysql && !useMariadb) {
     const pgIdent = (v) => `"${v.replace(/"/g, '""')}"`;
     const pgLit = (v) => `'${v.replace(/'/g, "''")}'`;
@@ -300,8 +583,9 @@ function buildManagedDbEnv(database) {
   if (!database?.name)
     return {};
   const isSingleStore = database.engine === "singlestore";
-  const connection = database.engine === "postgres" ? "pgsql" : isSingleStore ? "singlestore" : "mysql";
-  const port = database.port ?? (database.engine === "postgres" ? 5432 : 3306);
+  const isVitess = database.engine === "vitess";
+  const connection = database.engine === "postgres" ? "pgsql" : isSingleStore ? "singlestore" : isVitess ? "vitess" : "mysql";
+  const port = database.port ?? (database.engine === "postgres" ? 5432 : isVitess ? 15306 : 3306);
   const env = {
     DB_CONNECTION: connection,
     DB_HOST: database.host || "127.0.0.1",
@@ -312,7 +596,7 @@ function buildManagedDbEnv(database) {
     env.DB_USERNAME = database.username;
   if (database.password)
     env.DB_PASSWORD = database.password;
-  if (isSingleStore && database.ssl !== false)
+  if ((isSingleStore || isVitess) && database.ssl !== false)
     env.DB_SSL = "true";
   return env;
 }
@@ -433,8 +717,8 @@ function buildBackupRestoreScript(database, options = {}) {
 }
 
 // src/drivers/shared/maintenance.ts
-function buildAutoUpdatesScript(enabled2 = true) {
-  if (!enabled2)
+function buildAutoUpdatesScript(enabled3 = true) {
+  if (!enabled3)
     return [];
   return [
     "export DEBIAN_FRONTEND=noninteractive",
@@ -468,17 +752,17 @@ var SERVICE_PROBES = [
 ];
 function resolveMonitoring(monitoring = true) {
   const obj = typeof monitoring === "object" ? monitoring : {};
-  const enabled2 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
+  const enabled3 = typeof monitoring === "boolean" ? monitoring : monitoring.enabled !== false;
   return {
-    enabled: enabled2,
+    enabled: enabled3,
     cpuLoadPerCore: obj.alerts?.cpuLoadPerCore ?? DEFAULT_CPU_LOAD_PER_CORE,
     memPercent: obj.alerts?.memPercent ?? DEFAULT_MEM_PERCENT,
     diskPercent: obj.alerts?.diskPercent ?? DEFAULT_DISK_PERCENT
   };
 }
 function buildMonitoringScript(monitoring = true) {
-  const { enabled: enabled2, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
-  if (!enabled2)
+  const { enabled: enabled3, cpuLoadPerCore, memPercent, diskPercent } = resolveMonitoring(monitoring);
+  if (!enabled3)
     return [];
   const probeLines = SERVICE_PROBES.map(([name, port]) => `SVC_${name.toUpperCase()}=$(probe ${port})`);
   const servicesJson = SERVICE_PROBES.map(([name]) => `"${name}":"$SVC_${name.toUpperCase()}"`).join(",");
@@ -765,7 +1049,7 @@ function buildNginxVhost(options) {
 }
 function buildNginxVhostScript(options) {
   const available = `/etc/nginx/sites-available/${options.siteName}`;
-  const enabled2 = `/etc/nginx/sites-enabled/${options.siteName}`;
+  const enabled3 = `/etc/nginx/sites-enabled/${options.siteName}`;
   const vhost = buildNginxVhost(options);
   const out = [...buildNginxServiceScript()];
   if (options.auth) {
@@ -775,7 +1059,7 @@ function buildNginxVhostScript(options) {
     const user = sq(options.auth.username);
     out.push(`TS_CLOUD_HTPASS=$(openssl passwd -apr1 '${pw}')`, `printf '%s:%s\\n' '${user}' "$TS_CLOUD_HTPASS" > ${file}`, `chmod 640 ${file}`, `chown root:www-data ${file} 2>/dev/null || true`);
   }
-  out.push(`cat > ${available} <<'TS_CLOUD_NGINX_EOF'`, vhost.replace(/\n$/, ""), "TS_CLOUD_NGINX_EOF", `ln -sf ${available} ${enabled2}`, "rm -f /etc/nginx/sites-enabled/default", `${NGINX_WRAPPER} -t`, "systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true");
+  out.push(`cat > ${available} <<'TS_CLOUD_NGINX_EOF'`, vhost.replace(/\n$/, ""), "TS_CLOUD_NGINX_EOF", `ln -sf ${available} ${enabled3}`, "rm -f /etc/nginx/sites-enabled/default", `${NGINX_WRAPPER} -t`, "systemctl reload ts-cloud-nginx 2>/dev/null || systemctl restart ts-cloud-nginx 2>/dev/null || true");
   return out;
 }
 var NGINX_WRAPPER = "/usr/local/bin/ts-cloud-nginx";
@@ -1420,7 +1704,13 @@ function buildCertManagementCommands(options) {
     `DOMAINS='${csv}'`,
     'before=$(cat "$CERTS"/*.crt 2>/dev/null | sha256sum)',
     `for d in ${spaced}; do`,
-    '  [ -s "$CERTS/$d.crt" ] || $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    '  if [ ! -s "$CERTS/$d.crt" ]; then',
+    '    $TLSX acme:issue -d "$d" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --prod --email "$EMAIL" || echo "issue $d failed (non-fatal)"',
+    "    # rpx reloads its SNI set when a PEM appears. Complete that reload",
+    "    # before the next hostname starts http-01, or :80 can disappear in",
+    "    # the middle of the following challenge on a multi-domain deploy.",
+    `    [ -s "$CERTS/$d.crt" ] && systemctl restart ${RPX_SERVICE_NAME}`,
+    "  fi",
     "done",
     '$TLSX acme:renew --domains "$DOMAINS" --method http-01 --webroot "$WEBROOT" --dir "$CERTS" --days 30 --prod --email "$EMAIL" || echo "renew: some domains failed (non-fatal)"',
     'rm -f "$CERTS"/*.chain.crt',
@@ -2516,6 +2806,65 @@ class HetznerClient {
     });
     return data.action;
   }
+  async powerOffServer(serverId) {
+    const data = await this.request("POST", `/servers/${serverId}/actions/poweroff`, {});
+    return data.action;
+  }
+  async stopServer(serverId, options) {
+    const server = await this.getServer(serverId);
+    if (server.status === "off")
+      return;
+    await this.shutdownServer(serverId);
+    const grace = options?.gracefulWaitMs ?? 120000;
+    const poll = options?.pollIntervalMs ?? 3000;
+    const start = Date.now();
+    while (Date.now() - start < grace) {
+      if ((await this.getServer(serverId)).status === "off")
+        return;
+      await new Promise((resolve) => setTimeout(resolve, poll));
+    }
+    const action = await this.powerOffServer(serverId);
+    await this.waitForAction(action.id);
+    await this.waitForServerStatus(serverId, "off");
+  }
+  async renameServer(serverId, name) {
+    const data = await this.request("PUT", `/servers/${serverId}`, { name });
+    return data.server;
+  }
+  async listImages(options) {
+    const query = options?.type ? `?type=${encodeURIComponent(options.type)}` : "";
+    return this.requestAll(`/images${query}`, "images");
+  }
+  async getImage(id) {
+    const data = await this.request("GET", `/images/${id}`);
+    return data.image;
+  }
+  async createImage(serverId, options) {
+    return this.request("POST", `/servers/${serverId}/actions/create_image`, { description: options.description, type: options.type ?? "snapshot", labels: options.labels });
+  }
+  async deleteImage(imageId) {
+    await this.request("DELETE", `/images/${imageId}`);
+  }
+  async rebuildServer(serverId, image) {
+    const data = await this.request("POST", `/servers/${serverId}/actions/rebuild`, {
+      image
+    });
+    return data.action;
+  }
+  async listPrimaryIps() {
+    return this.requestAll("/primary_ips", "primary_ips");
+  }
+  async unassignPrimaryIp(ipId) {
+    const data = await this.request("POST", `/primary_ips/${ipId}/actions/unassign`, {});
+    return data.action;
+  }
+  async assignPrimaryIp(ipId, serverId) {
+    const data = await this.request("POST", `/primary_ips/${ipId}/actions/assign`, {
+      assignee_id: serverId,
+      assignee_type: "server"
+    });
+    return data.action;
+  }
   async waitForAction(actionId, options) {
     const pollInterval = options?.pollIntervalMs ?? 2000;
     const maxWait = options?.maxWaitMs ?? 300000;
@@ -2696,16 +3045,16 @@ class HetznerDriver {
     this.client = options.client ?? new HetznerClient({
       apiToken: apiToken ?? ""
     });
-    const settings = resolveHetznerSettings(undefined, {
+    const settings2 = resolveHetznerSettings(undefined, {
       sshPrivateKeyPath: options.sshPrivateKeyPath,
       sshPublicKeyPath: options.sshPublicKeyPath,
       sshUser: options.sshUser,
       location: options.location
     });
-    this.sshPrivateKeyPath = settings.sshPrivateKeyPath;
-    this.sshPublicKeyPath = settings.sshPublicKeyPath;
-    this.sshUser = settings.sshUser;
-    this.location = settings.location;
+    this.sshPrivateKeyPath = settings2.sshPrivateKeyPath;
+    this.sshPublicKeyPath = settings2.sshPublicKeyPath;
+    this.sshUser = settings2.sshUser;
+    this.location = settings2.location;
     this.waitForBoot = options.waitForBoot ?? true;
     this.bootWait = {
       sshIntervalMs: options.bootWait?.sshIntervalMs ?? 5000,
@@ -4690,6 +5039,9 @@ function deployHistoryPath(base) {
 function deployLogPath(base, releaseId) {
   return `${deployMetaDir(base)}/deploys/${releaseId}.log`;
 }
+function sharedPathsManifestPath(base) {
+  return `${deployMetaDir(base)}/shared-paths`;
+}
 function releasePaths(base, releaseId) {
   const root = base.replace(/\/+$/, "");
   return {
@@ -4706,17 +5058,59 @@ function isFileSharedPath(p) {
     return true;
   return /\.[a-z0-9]+$/i.test(name);
 }
+function sharedPathOf(entry) {
+  return typeof entry === "string" ? entry : entry.path;
+}
+function dedupeSharedPaths(entries) {
+  const byPath = new Map;
+  for (const entry of entries)
+    byPath.set(sharedPathOf(entry), entry);
+  return [...byPath.values()];
+}
+function resolveSharedPath(paths, entry) {
+  if (typeof entry === "string")
+    return { path: entry, target: `${paths.shared}/${entry}`, seed: true };
+  return {
+    path: entry.path,
+    target: entry.target ?? `${paths.shared}/${entry.path}`,
+    seed: entry.seed !== false
+  };
+}
+function buildAdoptSharedPathFn(paths) {
+  return [
+    "ts_cloud_adopt_shared() {",
+    '  TS_CLOUD_SP="$1"',
+    '  TS_CLOUD_DST="$2"',
+    `  TS_CLOUD_SRC="${paths.current}/$TS_CLOUD_SP"`,
+    '  if [ -e "$TS_CLOUD_DST" ]; then return 0; fi',
+    '  if [ -L "$TS_CLOUD_SRC" ] || [ ! -e "$TS_CLOUD_SRC" ]; then return 0; fi',
+    '  mkdir -p "$(dirname "$TS_CLOUD_DST")"',
+    '  cp -a "$TS_CLOUD_SRC" "$TS_CLOUD_DST"',
+    "  for TS_CLOUD_SIDECAR in -wal -shm; do",
+    '    if [ -f "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" ]; then cp -a "$TS_CLOUD_SRC$TS_CLOUD_SIDECAR" "$TS_CLOUD_DST$TS_CLOUD_SIDECAR"; fi',
+    "  done",
+    '  echo "[ts-cloud] adopted $TS_CLOUD_SP from the live release into shared/ — it now survives deploys"',
+    "  return 0",
+    "}"
+  ];
+}
 function buildEnsureReleaseLayout(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
-  const lines = [`mkdir -p ${paths.releases} ${paths.shared}`];
-  for (const p of sharedPaths) {
+  const lines = [`mkdir -p ${paths.releases} ${paths.shared}`, ...buildAdoptSharedPathFn(paths)];
+  const resolved = sharedPaths.map((entry) => resolveSharedPath(paths, entry));
+  for (const { path: p, target, seed } of resolved) {
+    if (!seed)
+      continue;
+    lines.push(`ts_cloud_adopt_shared '${p}' '${target}'`);
     if (isFileSharedPath(p)) {
-      lines.push(`mkdir -p "$(dirname ${paths.shared}/${p})"`, `touch ${paths.shared}/${p}`);
+      lines.push(`mkdir -p "$(dirname ${target})"`, `touch ${target}`);
     } else if (p === "storage") {
-      lines.push(`mkdir -p ${paths.shared}/storage/app/public`, `mkdir -p ${paths.shared}/storage/framework/cache/data`, `mkdir -p ${paths.shared}/storage/framework/sessions`, `mkdir -p ${paths.shared}/storage/framework/testing`, `mkdir -p ${paths.shared}/storage/framework/views`, `mkdir -p ${paths.shared}/storage/logs`);
+      lines.push(`mkdir -p ${target}/app/public`, `mkdir -p ${target}/framework/cache/data`, `mkdir -p ${target}/framework/sessions`, `mkdir -p ${target}/framework/testing`, `mkdir -p ${target}/framework/views`, `mkdir -p ${target}/logs`);
     } else {
-      lines.push(`mkdir -p ${paths.shared}/${p}`);
+      lines.push(`mkdir -p ${target}`);
     }
   }
+  const manifest = sharedPathsManifestPath(paths.base);
+  lines.push(`mkdir -p ${deployMetaDir(paths.base)}`, `cat > ${manifest} <<'TS_CLOUD_SHARED_PATHS_EOF'`, ...resolved.map((entry) => `${entry.path}	${entry.target}`), "TS_CLOUD_SHARED_PATHS_EOF");
   return lines;
 }
 function buildDeployLock(paths, waitSeconds = 900) {
@@ -4769,25 +5163,47 @@ function buildPromoteStagedRelease(paths) {
 }
 function buildLinkSharedPaths(paths, sharedPaths = DEFAULT_SHARED_PATHS) {
   const lines = [];
-  for (const p of sharedPaths) {
-    const target = `${paths.shared}/${p}`;
+  for (const entry of sharedPaths) {
+    const { path: p, target, seed } = resolveSharedPath(paths, entry);
     const link = `${paths.release}/${p}`;
-    lines.push(`rm -rf ${link}`, `mkdir -p "$(dirname ${link})"`, `ln -sfn ${target} ${link}`);
+    const relink = [`rm -rf ${link}`, `mkdir -p "$(dirname ${link})"`, `ln -sfn ${target} ${link}`];
+    if (seed) {
+      lines.push(...relink);
+      continue;
+    }
+    lines.push(`if [ -e ${target} ]; then`, ...relink.map((l) => `  ${l}`), "fi");
   }
   return lines;
 }
+function buildRelinkSharedPaths(paths, releaseExpr) {
+  const manifest = sharedPathsManifestPath(paths.base);
+  return [
+    `if [ -f ${manifest} ]; then`,
+    '  while IFS="\t" read -r TS_CLOUD_SP TS_CLOUD_TGT; do',
+    '    [ -n "$TS_CLOUD_SP" ] || continue',
+    `    [ -n "$TS_CLOUD_TGT" ] || TS_CLOUD_TGT="${paths.shared}/$TS_CLOUD_SP"`,
+    '    [ -e "$TS_CLOUD_TGT" ] || continue',
+    `    rm -rf ${releaseExpr}/"$TS_CLOUD_SP"`,
+    `    mkdir -p "$(dirname ${releaseExpr}/"$TS_CLOUD_SP")"`,
+    `    ln -sfn "$TS_CLOUD_TGT" ${releaseExpr}/"$TS_CLOUD_SP"`,
+    `  done < ${manifest}`,
+    "fi"
+  ];
+}
 function buildActivateRelease(paths) {
   return [`ln -sfn ${paths.release} ${paths.current}.tmp`, `mv -Tf ${paths.current}.tmp ${paths.current}`];
 }
 function buildRollbackScript(paths, options = {}) {
   const flip = options.to ? [
     `[ -d ${paths.releases}/${options.to} ] || { echo "rollback target ${paths.releases}/${options.to} not found" >&2; exit 1; }`,
+    ...buildRelinkSharedPaths(paths, `${paths.releases}/${options.to}`),
     `ln -sfn ${paths.releases}/${options.to} ${paths.current}.tmp`,
     `mv -Tf ${paths.current}.tmp ${paths.current}`
   ] : [
     `TS_CLOUD_CURRENT=$(readlink -f ${paths.current} 2>/dev/null || true)`,
     `TS_CLOUD_PREV=$(ls -1dt ${paths.releases}/*/ 2>/dev/null | sed 's#/$##' | while read -r r; do ` + '[ "$(readlink -f "$r")" != "$TS_CLOUD_CURRENT" ] && { echo "$r"; break; }; done)',
     '[ -n "$TS_CLOUD_PREV" ] || { echo "no previous release to roll back to" >&2; exit 1; }',
+    ...buildRelinkSharedPaths(paths, '"$TS_CLOUD_PREV"'),
     `ln -sfn "$TS_CLOUD_PREV" ${paths.current}.tmp`,
     `mv -Tf ${paths.current}.tmp ${paths.current}`,
     'echo "rolled back to $TS_CLOUD_PREV"'
@@ -4875,7 +5291,7 @@ function buildSiteDeployScript(options) {
   const unitBase = `${slug}-${siteName}`;
   const serviceName = `${unitBase}.service`;
   const tarball = releaseTarballTmpPath(slug, siteName, releaseId);
-  const sharedPaths = [...new Set([".env", ...options.sharedPaths ?? []])];
+  const sharedPaths = dedupeSharedPaths([".env", ...options.sharedPaths ?? []]);
   const envFile = formatEnvFile(envEntries);
   const preStart = preStartCommands.length > 0 ? [`cd ${paths.release}`, ...preStartCommands] : [];
   const stageRelease = [
@@ -5353,7 +5769,7 @@ function queueUnitName(slug, siteName, index) {
 function daemonUnitName(slug, siteName, daemon, index) {
   return `${slug}-${siteName}-daemon-${daemon.name ? slugify(daemon.name) : slugify(daemon.command).slice(0, 32) || String(index)}`;
 }
-function systemdUnit(opts) {
+function systemdUnit2(opts) {
   const lines = [
     "[Unit]",
     `Description=${opts.description}`,
@@ -5400,7 +5816,7 @@ function buildSiteServicesScript(options) {
     for (let p = 0;p < processes; p++) {
       const name = queueUnitName(slug, siteName, desiredUnits.length);
       desiredUnits.push(name);
-      out.push(...writeUnitScript(name, systemdUnit({
+      out.push(...writeUnitScript(name, systemdUnit2({
         description: `${siteName} queue worker ${qIndex}.${p} (managed by ts-cloud)`,
         workingDir: current,
         execStart: driver.wrapExec(driver.queueWorkerCommand(worker, ctx)),
@@ -5415,7 +5831,7 @@ function buildSiteServicesScript(options) {
     for (let p = 0;p < processes; p++) {
       const name = `${daemonUnitName(slug, siteName, daemon, dIndex)}-${p}`;
       desiredUnits.push(name);
-      out.push(...writeUnitScript(name, systemdUnit({
+      out.push(...writeUnitScript(name, systemdUnit2({
         description: `${siteName} daemon ${daemon.name || daemon.command} (managed by ts-cloud)`,
         workingDir: daemon.directory || current,
         execStart: driver.wrapExec(daemon.command),
@@ -5430,7 +5846,7 @@ function buildSiteServicesScript(options) {
   const schedulerUnit = `${slug}-${siteName}-scheduler`;
   if (schedulerEnabled && driver.schedulerMode === "daemon") {
     desiredUnits.push(schedulerUnit);
-    out.push(...writeUnitScript(schedulerUnit, systemdUnit({
+    out.push(...writeUnitScript(schedulerUnit, systemdUnit2({
       description: `${siteName} scheduler (managed by ts-cloud)`,
       workingDir: current,
       execStart: driver.wrapExec(driver.schedulerCommand(ctx)),